{"id":"CVE-2026-96382","kind":"vulnerability","aliases":["CVE-2026-96382"],"related":[],"title":"Drupal Diba carousel slider: stored XSS through input handling up to 3.0.2","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.","summary":"The Diba carousel slider module for Drupal does not neutralize some user-supplied input before writing it into web pages, so the stored content can run script in visitors' browsers. An attacker who can get content stored through the module can run script in the browser of anyone who views the affected page.","severity":"medium","cvss":4.6,"epss":0.00133,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Diba carousel slider version in the Drupal project (`composer show drupal/diba` or the Extend page) and see whether it is `3.0.2` or earlier.\n- unknown","fix":"- Upgrade the Diba carousel slider module to a version later than `3.0.2`; the fixed version number is unknown from the sources.","status":"open","published_at":"2026-10-22T02:17:08+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:35:21+00:00","updated_at":"2026-10-25T04:35:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:35:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Diba carousel slider module to a version later than `3.0.2`; the fixed version number is unknown from the sources.","reach":"internet","title":"Drupal Diba carousel slider: stored XSS through input handling up to 3.0.2","impact":"medium","summary":"The Diba carousel slider module for Drupal does not neutralize some user-supplied input before writing it into web pages, so the stored content can run script in visitors' browsers. An attacker who can get content stored through the module can run script in the browser of anyone who views the affected page.","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in visitors' browsers via stored content","analyst_note":"Confirm the fixed version, the vulnerable input field and the required privilege at https://nvd.nist.gov/vuln/detail/CVE-2026-96382 and the Drupal security advisory.","how_to_check":"- Check the installed Diba carousel slider version in the Drupal project (`composer show drupal/diba` or the Extend page) and see whether it is `3.0.2` or earlier.\n- unknown","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the Diba carousel slider module installed at version 3.0.2 or earlier. The sources do not say which configuration or user roles store the input, so sites without the module can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00061,"input_tokens":3355,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-96382':15A,18A '0.0.0':108C '3.0.2':12A,110C 'affect':77B,102C 'allow':97C 'anyon':73B 'attack':57B 'browser':55B,71B 'carousel':3A,27B,95C,104C 'content':49B,61B 'cross':88C 'cross-sit':87C 'cve':13A,16A 'diba':2A,26B,94C,103C 'drupal':1A,19B,31B,93C 'generat':86C 'get':60B 'handl':9A 'host':24B 'improp':79C 'input':8A,39B,82C 'issu':101C 'modul':29B,65B 'neutral':34B,80C 'packag':20B 'page':45B,78B,85C 'php':21B 'run':51B,67B 'script':52B,68B,90C 'self':23B 'self-host':22B 'site':89C 'slider':4A,28B,96C,105C 'store':5A,48B,62B,98C 'suppli':38B 'user':37B 'user-suppli':36B 'version':106C 'view':75B 'visitor':54B 'vulner':91C 'web':44B,84C 'write':41B 'xss':6A,99C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the Diba carousel slider module installed at version 3.0.2 or earlier. The sources do not say which configuration or user roles store the input, so sites without the module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96382","severity":null,"published_at":"2026-10-22T02:17:08+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96382","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96382","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}